Owner: DevOps / Infrastructure Engineer (AI Architecture & Technology function)
Accountable seat: AI Architecture & Technology Lead
Contributors: AI Architect (Platform) · CEO (security incidents + major
infrastructure decisions) · Finance & Legal Lead (data sovereignty + compliance requirements and audit)
Department: D5 — Infrastructure & Compliance
Entity: PrivateAI (primary) · REMAP.ai (supporting)
Status: Recommended draft · Pending DevOps Engineer review
Version: 0.1 | Last updated: 2026-07-18
ℹ️ In the BOS, platform, security and compliance implementation sit with the
AI Architecture & Technology seat. The DevOps Engineer implements; Finance & Legal
defines the requirements and audits. See the
AI Architecture & Technology seat charter.
Where this hub and the charter differ, the charter applies.
⚠️ This is a recommended draft prepared by the BA from operational
context and PrivateAI's known infrastructure stack. The DevOps Engineer must review and
validate all technical specifics before these pages are treated as operational.
D5 owns the technical foundation that every PrivateAI delivery engagement runs
on — the hosted n8n environment, AWS infrastructure, client deployment pipelines,
ongoing maintenance, and security incident response. It also enforces the
compliance posture (ISO 27001/27701, GDPR, HIPAA-ready, SOC2, Essential Eight,
MAS TRM/PDPA) that underpins the PrivateAI brand promise.
⚠️ CEO involved — security incidents. The CEO is notified immediately on
any P1 security or data breach incident (INF-02). The CEO is also consulted on
major infrastructure architecture decisions that carry commercial or compliance
risk.
| ID | Name | Owner | Version | Status |
|---|---|---|---|---|
| INF-01 | PrivateAI Infrastructure Master | DevOps Engineer | 0.1 | Recommended draft |
| INF-01a | Client Infrastructure Deployment | DevOps Engineer | 0.1 | Recommended draft |
| INF-01b | Infrastructure Support & Maintenance | DevOps Engineer | 0.1 | Recommended draft |
| INF-02 | Security Incident & Breach Response | DevOps Engineer + Finance & Legal Lead | 0.1 | Recommended draft |
INF-01 (Infrastructure Master — always-on governance)
↓
INF-01a (Client Infrastructure Deployment)
→ Triggered by CS-01c onboarding or DEL-03/DEL-04 delivery
→ Provisions per-client AWS environment
↓
INF-01b (Infrastructure Support & Maintenance)
→ Runs continuously post-deployment
→ Monitors, patches, and maintains all environments
↓
INF-02 (Security Incident & Breach Response)
→ Triggered by any security or data incident
→ Runs alongside all other workflows — always-on
| Component | Tool / Platform | Status |
|---|---|---|
| Cloud provider | AWS | Confirmed |
| Automation platform | n8n (self-hosted) | Confirmed |
| Knowledge base | Wiki.js (self-hosted at wiki.remap.ai) | Confirmed |
| Container orchestration | TBD — pending OPS-O02 | Assessing |
| Monitoring | TBD — pending OPS-O02 | Assessing |
| Secret management | TBD — pending OPS-O02 | Assessing |
| CI/CD pipeline | TBD — pending OPS-O02 | Assessing |
| Database | TBD — pending OPS-O02 | Assessing |
| Framework | Jurisdiction | Coverage |
|---|---|---|
| ISO 27001 / 27701 | Global | Information security + privacy management |
| GDPR | EU / UK | Data protection and privacy |
| HIPAA | US | Healthcare data protection |
| SOC 2 | US | Service organisation controls |
| Essential Eight | AU | ASD cybersecurity framework |
| MAS TRM / PDPA | Singapore | Monetary Authority + Personal Data Protection |
From the AI Architecture & Technology seat charter.
| Action | Decided by | Notes |
|---|---|---|
| Production change or deployment on the platform | DevOps Engineer, with review | Change record kept; rollback defined |
| Departure from the agreed stack, or a client-hosted deployment | Architect proposes; Tech Lead decides | Data residency and support implications recorded |
| Granting access to client data or systems | Architect approves, logged | Least privilege; removed on exit |
| Declaring a security or platform incident | Tech Lead or DevOps Engineer | Integrator informed within 24 hours; CEO notified immediately on P1 (INF-02) |
| New tools, subscriptions or infrastructure spend | Propose | Per the Finance & Legal Delegation of Authority |
| Client uptime or response commitments in contracts | Tech Lead and Revenue Lead agree | None given today beyond six-hour critical response |
| Workflow | When the CEO is involved |
|---|---|
| INF-01 | Major architecture decisions with commercial or compliance risk |
| INF-01a | Not routinely — escalation only |
| INF-01b | Not routinely — escalation only |
| INF-02 | Notified immediately on P1 security or data breach · involved in client and regulatory notification decisions |
| # | Gap | Impact | Owner |
|---|---|---|---|
| 1 | INF-01 through INF-02 are recommended drafts — technical specifics not yet validated | All four pages need DevOps Engineer review before v0.9 | DevOps Engineer |
| 2 | Multiple infrastructure tool decisions TBD pending OPS-O02 | Monitoring, secrets management, CI/CD, database all unconfirmed | OPS-O02 |
| 3 | No formal infrastructure runbook exists per-client | Post-deployment support relies on tribal knowledge | DevOps Engineer |
| 4 | Wiki.js deployment and maintenance process not formally documented | Single point of failure if the DevOps Engineer is unavailable | DevOps Engineer |
| 5 | On-call arrangement, incident process and response targets not yet defined | No 24-hour cover; six-hour critical response not yet backed by a process | DevOps Engineer · approved by Tech Lead · due 31 Oct 2026 |